Ensure Context-Based Restrictions are implemented to enforce secure, conditional access to critical resources based on network location, IP range, or identity attributes

高等級 1人工審核ibmcloud

說明

IBM Cloud Context-Based Restrictions are a security feature that allows administrators to control access to cloud resources based on the context of the request, such as the IP address the request is made from, not just the identity of the user or service. IBM Cloud's Context-Based Restrictions (CBRs) provide an essential layer of defense by enforcing access conditions based on network location or type of endpoint, not just IAM roles. This means even if a user has the correct permissions, their request can be blocked if it originates from an untrusted context. By implementing CBRs, organizations can reduce the risk of unauthorized access, enforce compliance policies, and protect critical services like Cloud Object Storage, Key Protect, and Secrets Manager. In short, CBRs help turn identity-based access into context-aware security, which is vital in today’s hybrid and distributed enviro...

檢查方式

稽核方法: 人工審核

此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。

To check if you have a Context-Based Restriction (CBR) set in IBM Cloud, follow these steps: 1. Log in to the IBM Cloud Console: 2. Navigate to IAM, Context-based restrictions in the left-hand menu 3. Under the Rules tab, you'll see a list of all active CBR rules in your account. Each rule will show: o The network zone it applies to (e.g., IP ranges, VPCs) o The target service or resource (e.g., Cloud Object Storage, Key Protect) o The action (allow or deny) o Any conditions or exceptions 4. You can click on each rule to view its details, including which users or services it affects and when it was last modified. 5. If no rules are listed, then no CBRs are currently enforced in your account.

修補方式

修補方法: 操作指南或基礎設施修補檔

To create new trusted profile, complete the following steps: 1. Log in to the IBM Cloud Console: 2. Navigate to Manage, Context-based restrictions, then select Network zones from the left navigation menu. 3. click Create and define the network zone(s) you want to allow access from, using allowed or denied IP addresses, subnets, or ranges, VPCs, and IBM Cloud services. 4. Select Rules from the left navigation menu 5. Click Create and select the service, APIs, and resources you want the rule to apply to, select the context including the zone you defined, and specify whether to enable or report on this rule.

屬性

作業系統: 不限
標籤: access-controlcloudibmcloudnetwork
參考資料: CIS IBM Cloud Foundations Benchmark v2.0.0 - 1.12 Ensure Context-Based Restrictions are implemented to enforce secure, conditional access to critical resources based on network location, IP range, or identity attributes